[Hiring] Senior GRC Consultant @ScaleUp

Role Description

As a Senior GRC Consultant , you will lead audit readiness, compliance program development, and risk management across multiple client engagements. You'll own compliance frameworks end-to-end—from scoping and evidence collection to gap analysis, remediation guidance, and audit support.

This is a senior, client-facing position where you'll independently manage your own engagements while working directly with executive stakeholders and external auditors.

Key Responsibilities

• Lead compliance readiness engagements including SOC 2 Type I/II, ISO 27001, HIPAA, U.S. state privacy regulations, and UK/EU GDPR.
• Own GRC platforms such as Vanta, Drata, or similar tools, ensuring compliance monitoring remains fully operational and evidence is continuously maintained.
• Conduct formal risk assessments using frameworks such as NIST 800-30, translating technical findings into business and compliance risks.
• Design and implement complete GRC programs, including policies, control frameworks, risk management processes, and evidence collection.
• Perform internal audits, evaluating both control design and operational effectiveness while preparing audit-ready findings.
• Manage vendor security questionnaires, coordinating with internal subject matter experts and maintaining reusable knowledge bases.
• Build strong relationships with client leadership, lead recurring meetings, provide status updates, and manage expectations throughout each engagement.
• Produce high-quality client deliverables including policies, procedures, risk registers, control matrices, evidence packages, and assessment reports.

Qualifications

• 5–7+ years of hands-on experience in GRC, compliance, or information security audits.
• Previous consulting or professional services experience managing multiple client engagements.
• Strong expertise with both SOC 2 Type I & II and ISO 27001 / ISO 27002.
• Experience with one or more additional frameworks such as GDPR, CCPA/CPRA, or HIPAA.
• Experience building compliance programs from the ground up.
• Ability to map controls across multiple compliance frameworks.
• Solid technical understanding of cloud security, IAM, CI/CD pipelines, and security controls.
• Excellent documentation and technical writing skills.
• Professional-level English with confidence leading meetings with U.S.-based clients.

Nice to Have

• Experience working directly with external auditors.
• Hands-on experience implementing GDPR or U.S. privacy compliance programs.
• Knowledge of ISO 42001 (AI Management Systems).
• Certifications such as CISA, CISM, CRISC, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, or equivalent.

Benefits

• Join an early-stage, fast-growing cybersecurity startup.
• Work directly with founders and client leadership.
• Own high-impact client engagements from start to finish.
• Help innovative technology companies mature their security and compliance programs.
• Enjoy long-term remote work with significant autonomy, ownership, and career growth.